A European trading house receives a routine audit query from its US-headquartered parent. The query flags a shipment completed eight months earlier – a batch of industrial components sent to a distributor in a third market without the export licence that the Export Administration Regulations required. The compliance team had relied on a licence exception that did not, on the facts, apply. The goods had already reached their destination. What now?
Enforcement risk after a breach under the BIS / EAR turns on three variables: the nature of the violation, whether the exporter makes a voluntary self-disclosure (VSD – a proactive disclosure to the Bureau of Industry and Security before BIS discovers the violation independently), and how well the company can demonstrate a credible remediation effort. BIS has published a penalty matrix that treats VSD, cooperation, and compliance history as the primary mitigants.
This case comment walks through an anonymised matter in which a mid-sized exporter faced exactly this position: a discovered breach, a multi-regime exposure, and a compressed window in which to make decisions that would define the outcome.
The Situation: A Licence Exception That Did Not Apply
The exporter – a manufacturer of precision-engineered components used in industrial automation – had an internal classification matrix that assigned a low-level ECCN (Export Control Classification Number under the US Commerce Control List) to the product line. On that classification, an exception was marked as available for the intended destination. No one had verified the classification against the current Commerce Control List entry for the year of shipment, and the end-use certificate on file described a general industrial application without identifying the buyer's sector.
The problem emerged when the parent's US counsel reviewed the subsidiary's export records. The destination country was one where BIS maintained heightened scrutiny requirements for that ECCN category. The exception in question was not available for that country when the specific control reason applied. The shipment had cleared customs, reached the buyer, and been delivered to end-users whose precise identity the subsidiary had not verified.
In our experience, this combination – stale classification, assumed exception, unverified end-use, and a destination that sits at the boundary of a control list – is the pattern we see most often in post-breach instructions. The breach is rarely deliberate. It is nearly always a convergence of process failures.
How BIS Enforcement Works: The Authority and the Regime
BIS administers the Export Administration Regulations under the Export Control Reform Act, with civil enforcement authority to impose substantial monetary penalties and to deny export privileges to violators. The Office of Export Enforcement within BIS handles investigations; the Office of Chief Counsel handles penalty proceedings. DOJ's National Security Division handles criminal referrals where wilful conduct is alleged.
The penalty regime distinguishes between egregious and non-egregious cases. In egregious cases – those involving wilful conduct, harm to national security or foreign policy, or a designated entity on the Entity List (BIS's list of parties subject to licence requirements across all items subject to the EAR) – the base penalty can reach the statutory maximum per transaction. In non-egregious cases the base is lower, and mitigants reduce it materially.
BIS's published penalty guidelines identify the most powerful mitigants as: a timely and complete VSD, full cooperation with the investigation, no prior violations, a strong compliance programme in place at the time of the breach, and prompt remediation. Aggravating factors include harm to US national security or foreign policy interests, concealment, a pattern of violations, and the involvement of a sanctioned or controlled destination.
What is the practical difference between an egregious and a non-egregious determination? In a non-egregious case with a full VSD and strong compliance history, the effective penalty can be a fraction of the statutory ceiling. In an egregious case the floor rises sharply, and the risk of a denial order or criminal referral becomes real. The classification of the case depends on facts established in the first weeks after discovery – which is precisely why the initial response matters so much.
The First Decisions: VSD or Wait?
The company's most consequential decision in the first seventy-two hours was whether to make a VSD. This is not a procedural formality. It is a substantive commitment that, if the underlying facts are unfavourable, can be more damaging than the underlying breach if made incompletely.
We advised the company to complete an internal fact-finding exercise before deciding. That exercise had three objectives: first, to establish whether BIS had already opened an inquiry (which would transform a VSD into a post-discovery disclosure, with reduced mitigation value); second, to identify every transaction potentially caught by the same classification error, not only the flagged shipment; and third, to assess whether any end-user was on the Entity List, the Denied Persons List, or any OFAC list – a finding that would change the regulatory picture entirely.
The fact-finding took eleven business days. It identified three additional shipments over a fourteen-month period, all using the same incorrect exception, all to the same buyer. No end-user appeared on any US or UN list. BIS had not opened an inquiry.
The decision to make a VSD was straightforward once those facts were established. The conditions for a productive VSD – self-initiated, complete, and early – were present. A company that waits, hoping the matter will not surface, faces a materially worse position if BIS discovers the violation independently through a tip, a customs referral, or a related investigation.
If you are reading this in the days after an internal breach discovery, the question is not whether a VSD is a good idea in principle. The question is whether your facts support one, and whether you have the full picture before you commit to the disclosure.
Cross-Regime Exposure: Where BIS Risk Intersects Other Regimes
A BIS / EAR enforcement risk after a breach rarely sits in a single-regime vacuum. This matter illustrates that point directly. The exporter held a contractual relationship with an entity that had a minority shareholder flagged on an EU restrictive measures list. The shipment itself involved components with potential dual-use characteristics under EU Regulation 2021/821 on dual-use export controls. The parent company had a UK subsidiary with its own ECJU authorisation obligations for a related product category.
BIS enforcement does not automatically trigger parallel proceedings in other jurisdictions. However, a VSD filed with BIS will typically prompt US counsel to advise on whether the facts disclose obligations to self-report in other regimes. Under the relevant EU dual-use rules, an EU-established exporter that ships controlled items without the required EU authorisation faces a separate enforcement exposure before its national competent authority. The UK ECJU operates on a similar basis under the Export Control Order. These are independent obligations; BIS mitigation for the same physical shipment provides no credit in an EU or UK proceeding.
We coordinated with local counsel in the relevant EU jurisdiction to assess whether the company's EU export records disclosed a parallel authorisation gap. They did – a separate control-list entry applied under the EU regime, and the buyer's minority shareholder connection required an ownership and control analysis under EU ownership rules. That work ran concurrently with the BIS disclosure process. The two files were managed as separate matters with separate strategies, sharing only the factual record of the shipments.
For a comparison of EU enforcement exposure in a parallel breach scenario, see our related matter comment at Apparent Violation Assessment – EU Service. For a UK / OFSI enforcement comparison, the analytical framework is explored at Post-Breach Enforcement Risk: an OFSI Matter.
Remediation: What BIS Looks For
Filing a VSD opens the mitigation account. Remediation fills it. BIS expects to see, in any post-breach cooperation, a credible programme that addresses the root cause of the violation and reduces the probability of recurrence. This is not a box-ticking exercise. Examiners look for evidence that the company identified the specific systemic failure, corrected it, and tested the correction.
In this matter, the root cause was the stale classification matrix – a document that had not been reviewed when the Commerce Control List was amended to reflect updated multilateral controls. The remediation programme had four elements.
- A full re-classification review of the product catalogue against the current Commerce Control List, conducted by a qualified export-control specialist and signed off by the company's chief compliance officer.
- A revised exception-eligibility protocol requiring the compliance team to verify exception availability for each specific destination at the time of each licence determination, not at the time the product was first classified.
- An end-use verification procedure for any shipment to a destination subject to heightened BIS scrutiny, requiring a completed and reviewed end-use certificate that identified the buyer's sector and the specific application.
- A training programme for the logistics and compliance teams, documented and delivered within sixty days of the VSD filing date.
BIS reviewers in our cross-border practice respond well to remediation that is proportionate, specific, and evidenced. Generic policy updates without documented implementation carry little weight. The most effective remediation packages show the gap that existed, the process that created it, and the revised process that closes it.
Risk Flags for Businesses in a Similar Position
The lesson from this matter is not that export-control violations are inevitable. It is that the conditions for them are common and the detection lag is long. A business that exported controlled items under a misapplied exception last year may not learn of the problem until a parent-company audit, a customs flag, or a BIS inquiry surfaces it. By that point the mitigation window has shortened or closed.
Several risk flags recurred across the matters we handle in this area. Consider whether any of the following apply to your current export operations.
- Stale classifications: product classifications that were accurate at initial assignment but have not been reviewed against current control list versions, particularly after multilateral control list amendments.
- Exception over-reliance: teams that treat a licence exception as a permanent feature of a product-destination pair rather than verifying its availability for each specific transaction.
- Incomplete end-use documentation: certificates that identify the buyer but not the specific end-use or sector, leaving a gap that BIS can characterise as a failure to perform reasonable due diligence.
- Undiscovered Entity List exposure: a buyer that has not been screened since the original onboarding, during which period new listings may have been made against affiliated entities.
- Multi-regime blind spots: the US classification has been checked, but the EU and UK control list entries for the same item have not been reviewed, creating a parallel exposure that a BIS VSD will not resolve.
A common misconception is that export-control liability attaches only to deliberate violations. It does not. The EAR imposes strict liability for violations of its prohibitions in many circumstances; the absence of intent is a mitigant in penalty assessment, not a defence to the finding of a violation. Compliance counsel regularly encounter businesses that believe good faith is an answer to a breach. It is not – though it is a material factor in what happens next.
The Route Taken and the Lesson for Similar Businesses
The company made a full VSD covering all four transactions, supported by a complete factual record and the remediation programme described above. The VSD was filed with the Office of Export Enforcement regional office with jurisdiction over the exporter's US-linked operations. A written response from BIS acknowledging receipt arrived within the standard administrative window.
The matter resolved with a written warning and no monetary penalty. That outcome was not guaranteed and cannot be promised in any similar case. What made it achievable was the completeness of the disclosure, the absence of any Entity List or OFAC-listed party in the supply chain, no prior BIS violations on the company's record, the speed and quality of the remediation programme, and the fact that no US national security interest was identified as having been harmed by the specific items exported.
Change any one of those factors – a listed end-user, a prior violation, a controlled-country destination, a delay in filing – and the outcome would likely have been different. The lesson is structural, not incidental: the mitigation architecture is built in the weeks before the VSD, not after it is filed.
For businesses managing a post-breach position in Australia, the enforcement and remediation structure differs materially; the parallel is explored at Post-Breach Remediation: an Australia Matter.
Related practices
- Apparent Violation Assessment – EU – scoping EU enforcement exposure when a BIS breach has a parallel EU dimension
- Post-Breach Enforcement Risk: an OFSI Matter – how UK financial-sanctions enforcement differs from the BIS penalty model